Kingdom: Errors

Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with "API Abuse," there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle.

Poor Error Handling: ColdFusion Error

Universal

Abstract

The target ColdFusion application reveals potentially sensitive information within a publicly-displayed error message.

Explanation

A ColdFusion application might inadvertently display detailed error messages to the user. These error messages might contain sensitive information that can enable an attacker to conduct more targeted or damaging attacks.

References

[1] Specifying custom error messages with the cferror tag Macromedia, Inc.

[2] ColdFusion Error Handling Quackit.com

[3] Standards Mapping - Common Weakness Enumeration CWE ID 209

[4] Standards Mapping - Common Weakness Enumeration Top 25 2019 [4] CWE ID 200

[5] Standards Mapping - Common Weakness Enumeration Top 25 2020 [7] CWE ID 200

[6] Standards Mapping - Common Weakness Enumeration Top 25 2021 [20] CWE ID 200

[7] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001312, CCI-001314, CCI-003272

[8] Standards Mapping - FIPS200 AU

[9] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[10] Standards Mapping - NIST Special Publication 800-53 Revision 4 SA-15 Development Process and Standards and Tools (P2), SI-11 Error Handling (P2)

[11] Standards Mapping - NIST Special Publication 800-53 Revision 5 SA-15 Development Process and Standards and Tools, SI-11 Error Handling

[12] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[13] Standards Mapping - OWASP Application Security Verification Standard 4.0 8.3.4 Sensitive Private Data (L1 L2 L3), 14.3.1 Unintended Security Disclosure Requirements (L1 L2 L3), 14.3.3 Unintended Security Disclosure Requirements (L1 L2 L3)

[14] Standards Mapping - OWASP Top 10 2004 A7 Improper Error Handling

[15] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling

[16] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.7

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.2, Requirement 6.5.6

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.5

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.5

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.5

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.5

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.5

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[25] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 3.6 - Sensitive Data Retention

[26] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 3.6 - Sensitive Data Retention, Control Objective B.3.2 - Terminal Software Attack Mitigation

[27] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 3.6 - Sensitive Data Retention, Control Objective B.3.2 - Terminal Software Attack Mitigation

[28] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3120 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3120 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3120 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3120 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3120 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3120 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3120 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002570 CAT II, APSC-DV-002580 CAT II, APSC-DV-003235 CAT II

[50] Standards Mapping - Web Application Security Consortium Version 2.00 Improper Output Handling (WASC-22)

[51] Standards Mapping - Web Application Security Consortium 24 + 2 Information Leakage

desc.dynamic.xtended_preview.poor_error_handling_coldfusion_error